They use memory system detection. Sense, you're altering the memory of your client such as wallhack, speed, aimbot, etc. It'll found out that script and snatch it like a fly. It'll then add that hack it found to the database and anyone using any of the said 'detected' hack will be removed. :D